Death by Doki: Eine neue Docker-Schwachstelle mit ernstem Biss (und was du dagegen tun kannst)
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
Cyberangriffe werden immer häufiger und Bedrohungen, die Linux-basierte Infrastrukturen betreffen, werden immer häufiger. Das Endziel ist die Gelegenheit, eine Beutekiste mit sensiblen Daten, die in der Cloud gespeichert sind, zu öffnen.
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Eine Demo buchen
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
Klicken Sie auf den Link unten und laden Sie das PDF dieser Ressource herunter.
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Bericht ansehenEine Demo buchen
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
Inhaltsverzeichniss
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Eine Demo buchenHerunterladenRessourcen für den Einstieg
Themen und Inhalte der Securecode-Schulung
Unsere branchenführenden Inhalte werden ständig weiterentwickelt, um der sich ständig ändernden Softwareentwicklungslandschaft unter Berücksichtigung Ihrer Rolle gerecht zu werden. Themen, die alles von KI bis XQuery Injection abdecken und für eine Vielzahl von Rollen angeboten werden, von Architekten und Ingenieuren bis hin zu Produktmanagern und QA. Verschaffen Sie sich einen kleinen Einblick in das Angebot unseres Inhaltskatalogs nach Themen und Rollen.
%20(1).avif)
.avif)
Threat Modeling with AI: Turning Every Developer into a Threat Modeler
Walk away better equipped to help developers combine threat modeling ideas and techniques with the AI tools they're already using to strengthen security, improve collaboration, and build more resilient software from the start.
Ressourcen für den Einstieg
Cybermon is back: Beat the Boss KI-Missionen jetzt auf Abruf verfügbar
Cybermon 2025 Beat the Boss ist jetzt das ganze Jahr über in SCW verfügbar. Setzt fortschrittliche KI/LLM-Sicherheitsanforderungen ein, um die sichere KI-Entwicklung in einem großen Maßstab zu stärken.
Cyber-Resilienz-Gesetz erklärt: Was das für die Entwicklung von Secure by Design-Software bedeutet
Erfahren Sie, was der EU Cyber Resilience Act (CRA) verlangt, für wen er gilt und wie sich Entwicklungsteams mit sicheren Methoden, der Vorbeugung von Sicherheitslücken und dem Aufbau von Fähigkeiten für Entwickler darauf vorbereiten können.
